Automated Disambiguation of Fixed-Serverport-Based Applications from Ephemeral Applications

1. A method for partitioning a plurality of communication data relating to communication between at least one client computer and at least one server in a network, the plurality of communication data being associated with a plurality of ports and comprising ephemeral communication data, the method comprising: determining a first parameter for each port associated with the plurality of communication data, the first parameter corresponding to a number of connections on each port; determining a second parameter for each port associated with the plurality of communication data, the second parameter corresponding to a number of servers using each port; utilizing the first parameter and the second parameter for each port associated with the plurality of communication data to represent each port as a point in a two-dimensional space such that each port is represented by a set of points; applying a first data clustering to the set of points; based on the first data clustering, automatically identifying a portion of the set of points for which the first parameter and the second parameter are high, wherein ports corresponding to the portion of the set of points comprise global ports associated with first non-ephemeral communication data; eliminating the portion of the set of points from the set of points such that first communication data associated with the global ports is removed from the plurality of communication data; after removing the first communication data from the plurality of communication data, determining server, port pairs associated with the plurality of communication data remaining after the first communication data is removed; determining a third parameter for each server, port pair, the third parameter corresponding to a number of connections associated with each server, port pair; based on the third parameter for each server, port pair, applying a second data clustering to the server, port pairs; based on the second data clustering, automatically identifying a portion of the server, port pairs associated with a high number of connections, wherein the portion of the server, port pairs associated with the high number of connections comprises heavy hitter server, port pairs associated with second non-ephemeral communication data; eliminating second communication data associated with the heavy hitter server, port pairs from the plurality of communication data remaining after the first communication data is removed; and automatically identifying at least a portion of the plurality of communication data remaining after the first communication data and the second communication data are removed as the ephemeral communication data.

2. The method of claim 1 , wherein the first data clustering comprises first kmeans data clustering.

3. The method of claim 1 , wherein the second data clustering comprises second kmeans data clustering.

4. The method of claim 2 , further comprising transforming the first parameter and the second parameter to a logarithmic scale.

5. The method of claim 2 , further comprising normalizing the first parameter and the second parameter.

6. The method of claim 2 , wherein the first kmeans data clustering comprises: determining a location of each port based on a value of the first parameter and the second parameter corresponding to each port; determining a distance from the location of each port from a reference location; and partitioning each port in a cluster based on the value of the first parameter and the second parameter.

7. The method of claim 6 , wherein the first parameter of the portion of the set of points is greater than a threshold value.

8. The method of claim 7 , wherein the threshold value is based on the partitioning of each port in the cluster.